REMARKS 



/. In the Specification 

Amendments to the specification in Applicant's previous Amendment and 
Response of February 01, 2008 have been rejected under 35 USC §1 32(a) because 
the Examiner believes that the amendments add new matter to the specification. 

Applicant respectfully submits that for at least the reasons set forth below, and 
in view of the background infomiation submitted relating the basics of quantum key 
distribution, no new matter was added to Uie specification in tlie previous 
Amendment and Response. 

Applicant therefore requests that the Examiner reconsider his rejection of the 
Amendments to the specification in the previous Amendment and Response of 
February 01 , 2008, in light of the discussion below, and that the rejection of the 
Amendments to the specification be withdrawn and the Amendments entered. 

Information regarding "raw" and "sifted" keys 

The amendment to the "Background of the Invention" section that clarifies the 
meaning of the "raw key" and "sifted key" is basic background information that is 
known to one skilled in the art. This infomiation is described in the book by 
Bouwmeester et al., "The Physics of Quantum Infomiation," Springer-Verlag 2001 
("Bouwmeester") in Section 2.3, pages 27-33, which is cited in the "Background of 
the Invention" section. 

Applicant tias included pages 27-33 of Bouwmeester herewitfi. Section 
2.3 of Bouwmeester is entitled "Quantum Key Distribution with Single Particles" and 
discusses the basics of quantum key distribution using single particles in the form of 
polarized photons. The same basics apply identically with respect to raw and sifted 
key fomiatlon to a quantum key distribution system that phase modulates rather than 
polarization modulates the photons. 

The example described in Section 2.3 and summarized in Table 2.1 on 
page 29 states what every person skilled in the art of quantum key distribution 
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knows: the formation of raw and sifted freys is fundamental to performing 
quantum Icey distribution. 

Applicant's disclosure includes raw key formation and sifted key formation in 
the "Detailed Description of the Invention" section of the specification. 

For example, Applicant's paragraph [0020] reads as follows: 

[0020] With continuing reference to FIG. 1, in the normal 
operation of a QKD system such as QKD system 10, qubits 
are exchanged between Alice and Bob by controller 20 
causing laser 50 to emit weak (e.g., -0.1 photon) optical 
pulses. Controller 20 then provides basis and key bits via 
TRNG 30 (or alternatively via two separate TRNG's 30) to 
PMl to randomly encode the weak pulses. At Bob, control- 
ler 120 also causes PM2 to randomly select (via TRNG 120) 
a basis to measure and detect the modulated qubits at 
detector 150. 

One skilled in the art understands this description as constituting the basic steps 
used in quantum key distribution for fomiing the "raw key," and is entirely consistent 
with the description of raw key fomiation set forth in Bouwmeester. 

Applicant's paragraph [0033] and [0034] read as follows. 

[0033] At this point, Bob and Alice run standard QKD 
procedures (e.g., sifting, error correction, privacy amplifi- 
cation). It is preferable that all information sent during the 
latter procedures is encrypted with a cipher of the ciypto- 
graphic strength not lower than the stream cipher. Some 
information has to be authenticated, as required in the BB84 
protocol. 

[0034] Altematively, Alice and Bob can run sifting and/or 
error correction first and decrypt die bits afterwards. This 
would require some simple modifications of decryption 
nmcess. 

The "sifting" procedure referred to in these paragraphs is understood by one skilled in 
the art to constitute the formation of a "sifted key," as described in Bouwmeester. In 
fact, given that these two paragraphs both use the word sifting in connection with 
running standard QKD procedures, the position that the description in Applicant's 
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specification somehow does not support the formation of a sifted Arey defies reason. 

Applicant respectfully submits that for at least these reasons, and in view of 
the supporting material provided in Bouwmeester, the Applicant's addition of 
clarifying language to the "Background of the Invention" section relating to the "raw" 
and "sifted" keys is both inherently an expressly supported by the specification and 
so does not constitute the addition of "new matter" to the specification. 

Amendments to independent claims 1. 8 and 9 

The Examiner states that language added to independent claims 1, 8 and 9 of 
"without first forming unencrypted qubits from the optical pulses" is not supported by 
the specification and constitutes "new matter" added to the Application. 

In fact, this limitation is fully and expressly supported by Applicant's 
specification. For example. Applicant's paragraph [0021] and [0023] through [0028] 
read as follows: 

[0021] However, as discussed above, there are potential 
security shortcomings in this QKD process. To address these 
shortcomings, the present invention liirther involves 
encrypting (e.g., at the software level) using di module 40 
at least the key bits from TRNG 30 used to set Alice's phase 
modulator state for each qubit. This results in "mciypted 
qubits" being sent to Bob. 
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[0023] The method of encrypting Alice's key bits is illus- 
trated in FIGS. 2 and 3. Suppose there are bl, b2, . . . bi, . 
. . bn bits from TRNG 30 for basis and kl, k2, . . . ki, . . . 
kn bits to form a set of qubits. In an example embodiment, 
two TRNGs 30 are used to separately generate the basis and 
key bits, respectively. 

[0024] In an example embodiment of the invention, key- 
bit values ki are encrypted by e/d module 30 with a stream 
cipher (e.g., AES in CTR mode). To do diis, Bob and Alice 
must share a pre-agreed password. The stream cipher is 
needed because some qubits can be lost in quantum channel 
200. The loss of qubits during transmission precludes the use 
of other types of ciphers. 

[0025] Suppose Alice and Bob share a password P. In an 
example embodiment, password P is created by either using 
a fraction of their key generated by QKD. In another 
example embodiment, password P is created using one of the 
known method, such as secure currier or Difl&e-Hellman 
protocol. In an example embodiment, Alice and Bob agree 
to refresh the password P at a chosen rate. Having this 
password, they can generate a pad pi, p2, . . . pi, . . . pn by 
means of a stream cipher 

[0026] Once the pad is generated, Alice then performs in 
e/d module 30 the "exclusive OR" (XOR) operation: 

[0027] kiXORpi-ci 

[0028] Alice also sets her phase modulator PMl to encode 
ci on a qubit, not ki. This process is illustrated in the flow 
diagram of FIG. 3. The result is what is referred to herein as 
an "encrypted qubit" or an "encoded qubit." 
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One skilled in the art understands as axiomatic that in quantum key distribution, a 
qubit is not fomied until an optical pulse is modulated. Since the first modulation in 
Applicant's invention occurs with an encrypted modulation, it is also axiomatic (i.e., 
inherent) that in Applicant's invention, the encrypted qubit is formed without having 
formed an unencrypted qubit. There is simply no other way to encrypt qubits in 
Applicant's invention. 

Accordingly, the amended language for claims 1, 8 and 9 is fully supported by 
the specification in at least the paragraphs cited above and so does not constitute 
"new matter." 

Amendment to independent claim 5 

The Examiner also objects to the amendment to claim 5 that adds the 
limitation "simultaneously so as to simultaneously encoded {sic: encode} and encrypt 
the optical pulses to form encrypted qubits" and asserts that this constitutes "new 
matter" that must be canceled. 

Applicant respectfully disagrees with the Examiner. With reference to the 
above-cited paragraphs [0021] and [0023]-[0028], one skilled in the art understands 
from this enabling disclosure that the encoding of the optical pulse and the encrypting 
of the optical pulse occur simultaneously through the use of the encrypted key bits. 
There is no other way to do so in Applicant's invention. 

Accordingly, the amended language for claim 5 is fully supported by the 
specification in at least the above-cited paragraphs and so does not constitute "new 
matter." 

In view of the above reasons. Applicant respectfully requests the withdrawal of 
the objection to the above-cited amendments to the specification and claims. 
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In the Claims 

Claims 1-13 are pending in the application stand rejected. 

Claim 5 has been amended to correct a typographical error. 

Claim 10 as been amended to correct the dependency of this claim from itself 
to claim 8 as kindly pointed out by the Examiner. 

I. Claim reiection under 35 USC §112 

Claims 1-4 and 8-13 stand rejected under 35 USC §112, first paragraph, as 
failing to comply with the written description requirement and for not being enabled. 

For at least the reasons discussed above in connection with the objections 
under 35 USC § 132(a) to the amendments to the specification and claims made in 
the previous Amendment and Response for being "new matter," Applicant 
respectfully submits that the amendments to claims 1, 5, 8 and 9 are fully supported 
by the written description and enablement provided in at least paragraphs [0020] 
through [0028] of Applicant's specification. 

Applicant therefore respectfully requests withdrawal of the rejections under 
35 USC §1 12, first paragraph, of the above-cited claims for failure to satisfy the 
written description and enablement requirements. 

II. Reiections under 35 USC SI 03 

Claims 1 and 9 were rejected over U.S. Patent No. 5,757,912 to Blow ("Blow") 
in view of U.S. Patent Application Publication No. 2004/0032954 to Bonfrate et al. 
("Bonfrate"). 

An obvious rejection under 35 USC §1 03(a) requires that the combination of 
cited references yield all of the claim limitations. Also, the claim must be read as a 
whole to avoid the impermissible assembling bits and pieces of prior art to 
reconstruct Applicant's claimed invention using hindsight. 
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Claims 1-4 

The Examiner correctly points out that Blow does not teach encrypting the key 
bits and using the encrypted key bits to form encrypted qubits. The Examiner then 
asserts that "Bonfrate discloses encoding key information and having single optical 
photons (qubits) [that] carry said encoded key information" (citing Bonfrate paragraph 
[0007]). This statement stands for the usual prior art proposition that photons are 
encoded via phase modulation in order to form encoded (but unencrypted) qubits that 
form an encrypted key. This encoding is not the same as using encrypted key 
bits to form encrypted qubits. 

A closer reading of Bonfrate reveals that Bonfrate has nothing to do with 
forming encrypted qubits in the manner claimed by Applicant. Bonfrate discloses a 
quantum cryptography apparatus that "overcomes problems associated with 
polarisation evolution in quantum cryptography systems that incorporate a non- 
polarisation preserving optical channel (e.g., standard optical fiber)." See Abstract. 
Bonfrate does this by avoiding the use of an active random number generator and 
phase modulator at the receiver by using a polarization beam splitter (14) that serves 
as a random router. Paragraph [0029]; FIG. 1 . 

Simply stated, the encoding performed by Bonfrate is the usual polarization 
encoding used to form unencrypted qubits. It has nothing to do with forming 
encrypted qubits per Applicant's claimed invention. There is absolutely no 
teaching or suggestion in Bonfrate of forming encrypted qubits using 
encrypted liey bits. 

Therefore, the combination of Blow and Bonfrate cannot not yield all of the 
limitations in Applicant's claim 1 . Consequently, a prima facie case for obviousness 
cannot be established using these references. 

The obviousness rejection of Applicant's claim 1 is therefore traversed and 
withdrawal of the rejection is earnestly requested. For the same reasons, the 
obviousness rejection as applied to dependent claims 2-4 is also traversed and 
withdrawal of the obviousness rejection of these claims is earnestly requested. 
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Claims 5-7 



Claim 5 is rejected for the same reasons as claim 1 , and further in view of the 
article "Applied Cryptography" by Schneier ("Schneier"). Accordingly, the rejection of 
claim 5 and its dependent claims 6 and 7 is traversed for the same reasons set forth 
above in connection with the obviousness rejection of claims 1-4. 

Claim 8-13 

Claims 8-13 are rejected under 35 USC §1 03(a) as being unpatentable over 
U.S. Patent No. 5,675,648 to Townsend ("Townsend") in view of U.S. Patent 
Application Publication No. 2006/0120529 to Gisen et al. ("Gisen"), and further in 
view of Schneier and Bonfrate. 

Applicant reiterates here that a closer reading of Bonfrate reveals that 
Bonfrate has nothing to do with forming encrypted qubits in the manner 
claimed by Applicant Bonfrate discloses a quantum cryptography apparatus that 
"overcomes problems associated with polarisation evolution in quantum cryptography 
systems that incorporate a non-polarisation preserving optical channel (e.g., standard 
optical fiber)." See Abstract. Bonfrate does this by avoiding the use of an active 
random number generator and phase modulator at the receiver by using a 
polarization beam splitter (14) that serves as a random router. Paragraph [0029]; 
FIG. 1. 

The encoding performed by Bonfrate is the usual polarization encoding used 
to fomri unencrypted qubits. It has nothing to do with forming encrypted qubits per 
Applicant's claimed invention. 

The cited references and the arguments set forth by the Examiner indicate that 
the Examiner is not reading each claim as a whole to appreciate and understand the 
invention in its entirety. The Examiner seems to have fallen into the trap of using 
the claims as a guide to find references covering different features of the invention 
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without regard to what the invention covers as a whole. This is inripermissible 
hindsight reconstruction of the claims using the prior art. See, e.g., In re Fritch, 972 
F.2d 1260. 23 USPQ 2d 1780, 1784 (Fed. Cir. 1992). 

All of the cited patent references are directed to the conventional practice of 
quantum key distribution (QKD) that involved the random modulation of optical pulses 
to fomi unencrypted qubits. The Schneier reference is directed to classical 
encryption, and Applicant's Invention admits to using classical encryption since it is 
invention is entitled "QKD with classical bit encryption." However, it is the 
combination of claim elements taken as a whole that combine classical encryption 
with quantum cryptography in a unique and non-obvious way to provide enhanced 
security over existing quantum encryption systems. 

There is absolutely no teaching, suggestion or motivation in any of the cited 
references to form encrypted qubits using encrypted key bits in the manner claimed 
by the Applicant. Moreover, the combination of the cited references cannot yield 
all of the limitations in Applicant's claims 8-13. Consequently, a prima facie case 
for obviousness cannot be established using the cited references. 

Accordingly, the obviousness rejection of Applicant's claims 8-13 is traversed 
and withdrawal of the rejection is earnestly requested. 
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CONCLUSION 

Applicant respectfully submits that claims 1-13 as presently presented are in 
condition for allowance. 

Applicant believes that a three-month extension of time extension pursuant to 
37 C.F.R. § 1.136(a) in the amount of $525 is necessary to make this Reply timely, 
and hereby authorizes the Office to charge any necessary fee or surcharge with 
respect to said time extension to Deposit Account 502992 

The Examiner is encouraged to contact the Assignee's authorized 
representative at 941-378-2744 to discuss any questions that may arise in 
connection with this Amendment. 



Respectfully Submitted, 



By: ^^pi^l^^^jg^^ Date: September 24. 2008 
Joseph E. Gortych 
Reg. No. 41,791 



Customer No. 53590 

Opticus IP Law PLLC 
7791 Alister Mackenzie Dr 
Sarasota, FL 34240 USA 

Phone: 941-378-2744 
Fax: 321-256-5100 
E-mail: jg@opticus-ip.com 
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may contain no photon at all, while others contain 1, 2 or even more photons. 
Pulses with more than one photon per pulse should be avoided, smce they 
may leak information to an eavesdropper. In order to make the probability 
of more than one photon per pulse low enough, one needs to use very weak 
pulses, which in turns reduces the signal to noise ratio. The value generally 
adopted is 0.1 photon per pulse on average (this really means that only one 
pulse out of 10 contains a photon), which gives a probability of more than 
one photon of 5 x IQ-^. This still means that 5 % of the usable pulses (with 
at least one photon), contain two or more photons, and could leak informa- 
tion to an eavesdropper. Development of a good single photon source seems 
technologically possible, but has not been achieved yet. 

The second, more serious problem for practical apphcations of QC is that 
a quantum channel cannot be amplified without losing its quantum proper- 
ties. Therefore, due to losses in the transmission, QC can operate only over 
limited distances. For all existing systems, which are based on infrared pho- 
tons in silica fibres, the minimum loss rate is about 0.2 dB/km. So it seems 
that QC systems with a range of more than 100 km (with losses of 20 dB, 
or a transmission rate of 0.01) are not possible for the foreseeable future. 
Therefore, a transatlantic cable with QC secrecy remains a complete utopia 

for the time being. 

The third problem is that QC is well adapted to point-to-point exchanges,' 
but not so well to other types of networks. Recent proposals suggested some 
improvements in this direction [41], but these are still limited to one-to-a-few 
users. QC access for home-to-home transactions is still impractical. However, 
a kind of Local Area Network, with a central broadcasting station (e.g. the 
main branch of a bank) and a number of receivers (e.g. the local branches of 
the bank), is certainly conceivable. 



2.3 Quantum Key Distribution with Single Particles 
2.3.1 Polarised Photons 

Quantum key distribution with polarised photons, as originally proposed by 
C.H. Bennett and G.Brassard [38, 42], employed pulses of green hght m 
free space, over a distance of 40 cm, and .we shall discuss it in some detail. 
This experiment was obviously not useful for actual key transmission, but 
represented the first experimental steps of QC. The first implementation of 
this particular protocol with optical fibres (over a distance of about 1 km) 
was done at the university of Geneva [43]. Nowadays, distances have reached 
the tens of kilometers range. In this section, we shall present the principles 
of QC with polarised photons, leaving the experimental implementations to 

Sect. 2.6 . , 

Let us consider pulses of polarised light, eax:h pulse containing a single 
photon. We shall begin with polarisation either horizontal or vertical, denoted 
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Alice 



Fig. 2.4. Polarisation scheme: The sender, A ice sends very weak pulse oj pc. 
laSed light to Bob. The polarisation is controlled by a Pocke Is ceU (PCI), whjch 
enables Alice to choose between the four possible polarisations^ \t) , | , \^), 
f^f On Bob's side, a second Pockels cell (PC2) controls the rotation of the setup. 

corresponds to a measurement in ©). 

in the quantum mechanical Dirac notation by | and It) J^P^f J^^J^ "jj^ 
transmit information we need a coding system, say 1 1) codes for O, while 
L) codes for 1. Using this system, the sender, known as Ahce, can send any 
coaes loi i. ^ & j pvamole if Mice sends a series 

njessage to the « " i^, ': the cor- o^^^^^^^ binary number is 
foiT^W e^lJSilh^^^^^^^ 'or ,i) only, we sh^l say that Alice se^s 
her photons in the © basis. As the required key needs to be --^J, Ahce 
send 0 or 1 with equal probability. In order to detect the message, Bob uses a 
Polarisation Beam-splitter (PBS) transmitting the vertical polans^^^^^^^^^ 
deHecting the horizontal one. This is followed by smgle-photon detectors n 
each axm'of the set-up, ss shown in Fig. 2.4. Detection - ^etec*- D^^^^^ 
means that Alice sent a 0 (1). In this case, we shall say ^^at Bob detec^^^^^ 
the ® basis as well. As detectors are not perfect, and also due to possible 
oie!in the transmission, both detectors will often fail to register any photon^ 
In this case Bob shall tell Alice that he failed to register anything, and the 
S^^p^ding bit shall be discarded. Therefore, only a ^ac^^-J^X 
bits will be actually used, but the remammg ories should be shared by A >ce 
and Bob This system is thus useless for sending a given message, but it 
will be useful to send a cryptographic key, where the only requirements are 
randomness and confidentiality. 

Up to this point, our setup is totally insecure. The eavesdropper known 
as Eve. could also measure the pulses with a setup similax to Bob ^' 
re-send similar pulses to Bob. Eve would then know all the bits shared by 
Al-rld b1 To obtain confidentiality, Alice adds another random choic. 
she shall now use either the previous horizontal-vertical P°"°^^^^^^^^^^ 
basis)- or one of the two linear diagonal polarisations, with |^) denoting a 
^I^d I S) denoting a 1. Here again, Alice shall send a 0 or 1 with equal 
probabimy. This corr^ponds to the ® basis. By rotating his setup by 45 . 



Table 2^1 
or <S>) an^^ 
Bob. Bob^ 
ensembleiOM 



[ over ™ 
basis. This^p 
test for Ev^ 



that the tr^ 




Bob can also 
fundamental 
pulse prepare 
going toward 
there is not^ 
prepares a p! 
to measure, i| 
Dl, with eqii 
that half of | 
hprizontailjd 
' the ® basiSf 1 
-measured/i|| 
Obviouli] 
at randomV; 
. use. Whei^ 
not correlSfe 
know thail^l 
was prep^ 
orinthe^i^ 
do need sffi| 
wrong b£^ 
used the^ 
avoiding(^ 
has no otig 



This wili^ 
eavesdroj^ 
the possi|^^^^ 



2.3 Quantum Key Distribution with Single Particles 



29 



of po- 

which 

> 

setup: 
jasure- 
ito two 
chosen 



^ly- To 

while 
id any 

series 
iber is 

sends 
ce will 
uses a 
I while 
tors in 
0(D1) 
ects in 
ossible 
hoton. 
nd the 
•riginal 
/ Alice 

but it 
nts are 

known 
's, and 
xed by 
choice: 
(the © 
Dting a 
I equal 
45^ 



Table 2.1. Example of a polarisation protocol. Alice chooses at random a basis (® 
or ®) and a bit value (0 or 1), and sends the corresponding polarisation state to 
Bob. Bob chooses also at random the reception basis, and obtains a given bit. The 
ensemble of these bits is the raw key. Alice and Bob then tell each other the basis 
used over the public channel, and keep only the bits corresponding to the same 
basis. This is the sifted key. They choose at random some of the remaining bits to 
test for Eve, then discard them. In this case, there are no errors, which indicates 
that the transmission is secure. The remaining bits form the shared key 
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Bob can also choose to measure in the (S> basis. Safety is obtained thanks to a 
fundamental property of quantum mechanics: indeterminism. A single photon 
pulse prepared in the (8) basis and measured in the © basis has probability | of 
going towards either detector, DO or Dl. And this choice is purely random: 
there is nothing in the photon to reveal which way it will go. So if Alice 
prepares a photon in, say state | ^) , and Bob (or anybody else) attempts 
to measure it in the © basis, he may get a count in either detector, DO or 
Dl, with equal probability. Let us emphasise that this does not mean at all 
that half of the photons in a beam of | ^) are polarised vertically and half 
horizontally. This would be inconsistent with the fact that, when Bob uses 
the 0 basis, he always gets a 0. In fact, the systems behaves as if, when it is 
measured, it chooses randomly which way to go. 

Obviously, the above applies equally well to Eve. As Ahce uses either basis 
at random, there is no way for Eve to decide which measurement basis to 
use. Whenever she uses the wrong basis, she gets a random result, which is 
not correlated to Alice's choice. Another important point is that Eve cannot 

i know that she got a wrong result: a count in DO may mean that the photon 

was prepared in the 1 1) state, but it-^may also mean that it was in the | ^) 
or in the | \) state, and simply "choose" to go towards DO. This is why we 
do need single-photon pulses: a pulse with more than one photon sent in the 
wrong basis may give a count in both DO and Dl, thus telling Eve that she 
used the wrong basis. She could then simply discard the transmission, thus 
avoiding creating any error. However, when she receives only one photon, Eve 
has no other choice but to send it on to Bob, in the state that she measured. 
This will unavoidably create errors in the string received by Bob. The above 

I eavesdropping strategy, known as the iiitercept-resend strategy is only one of 

; the possibilities available to Eve. '* 

i 

i 
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Fig. 2.5. Diagram of single-photon based quantum key distribution protocol 

We now have the basic blocks for the polarisation cryptograpy protocol 
an 2Ze of which is given in Table 2.1. The whole protocol .s illustrated 
in Fig. 2.5 and is summarised as follows: 

Alice chooses at random both the basis and the polarisation of her single- 

2 S^h^P^S :jret^raf t^^^ which basis he will use and 
meases the pulse. He either registers the count in DO or Dl, or fails to 
TegX aiJS due to losses in the detection or in the transm.s.on. 
The ensemble of all the received bits is the raw key. 

"e melrement (count in DO or Dl). Alice answers back by telling 
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which basis she used. Whenever Alice and Bob used the same basis, 
either 0 or 0, they should get perfectly correlated bits. However, due to 
imperfections in the setup, and to a potential eavesdropper, there will be 
some errors. The ensemble of these bits is the sifted key. 
4. To transform their partly corrupted and maybe not entirely secret strings 
into a usable shared and secret key, Alice and Bob now need some pro- 
cessing. The processing stage is in fact common to all implementations of 
QC with single particles. The main steps are: to estimate the error rate 
of the transmission; to infer the maximum information that may have 
leaked to an eavesdropper; and then to correct all the errors, while re- 
ducing the information potentially available to Eve to any level required. 
The remaining string of bits is the secret key. 

Polarisation schemes are very appeaUng in free space, where polarisation 
is conserved, but are more complicated to implement in optical fibres, due 
to depolarisation and randomly fluctuating birefringence: Depolarisation is 
not a major problem: its effects can be suppressed by means of a sufficiently 
coherent source. The timescale of the fluctuations of the birefringence in sta- 
ble conditions is quite slow (1 hour). However, during an experiment on an 
installed cable, we have also observed much shorter timescales, which ren- 
dered transmission impossible. An electronic compensation system, enabling 
continuous tracking and correction of the polarisation is certainly possible, 
but requires an alignment procedure between Alice and Bob. This may make 
the scheme a bit too cumbersome for potential users. 

2,3.2 Phase Encoded Systems 

Instead of relying on polarisation, which is not easy to control in optical fibres, 
one can base a QC system on phase encoding. Originally the phase encoding, 
with optical fibres and the Mach-Zehnder interferometers, was introduced 
in the context of the entanglement-based quantum cryptography [44], but it 
can also be used with the single-particle schemes [45]. The theoretical setup 
is shown in Fig. 2.6. This is an extended Mach-Zehnder interferometer, with 
Alice on the left, and Bob on the right, with two connecting fibres. Both Alice 
and Bob have a phase modulator (PM) on their side to enable the coding and 
decoding. Let us assume for. the moment that Bob does not use his PM, and 
that the interferometer is aligned to have a constructive interference in DO, 
and a destructive one on Dl. If Alice uses her PM to get either 0 or tt phase 
shift (corresponding to bit value 0 and 1), Bob will either get a count in DO 
or in Dl. This is the equivalent of the previous scheme with two polarisations 
only. To obtain confidentiality, wc add the random choice of basis. Here, this 
means that Alice shall choose between four phase shifts: 0, tt (corresponding 
to the @ basis), and f , ^ (corresponding to the ® basis). On his side, Bob 
will also choose between 0 phase shift, i.e. measuring in the © basis, and 
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